Re: [Curdle] draft-ietf-curdle-rc4-die-die-die-06 review

[Daniel Migault <[e-mail]>]

Hi,

We would like to move the draft to the IESG, however, the draft has not
been updated to address the comments received on the mailing list. We have
privately contacted the author 3 times with the email address provided to
the draft, but we did not receive any response. The purpose of this email
is to first try to contact the author of draft via another channel and
understand if he has any plan to move the draft forward. In addition, we
would also like to see if there is any interest by some members of the
group to co-author the draft and move the draft forward. For those
interested in co-authoring the draft, please contact us privately.

Our goal is to have all drafts - that is the two remaining drafts in WGLC -
submitted by end of august.

Yours,
Rich and Daniel

On Tue, May 15, 2018 at 1:00 PM, Daniel Migault <[e-mail]
> wrote:

> Hi,
>
> Please find my review for draft-ietf-curdle-rc4-die-die-die-06 [1]. I
> have also proposed text, so please comment the review in the mail. I am
> willing to start a WGLC as soon as the draft is being updated.
>
> Yours,
> Daniel
>
>
> [1] https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-06
>
>
> RFC-Editor:
>
> I personally find the ton of the sentence a bit aggressive, thus I would
> remove it or just leave the RFC reference.
>
> """
> Non-ASCII characters are allowed in RFCs as per RFC 7997.
> """
>
> I see deprecation and move to historic status as very similar to
> draft-ietf-curdle-des-des-des-die-die-die-05 and I assume that is
> correct.
>
> Abstract:
>
> The sentence below is a bit hard to parse.
> ""
> and formally obsoletes and moves to
>    Historic RFC 4345.
> ""
>
> I would propose instead:
>
> """
> This document deprecates RC4 in Secure Shell (SSH).  Therefore, this
>    document updates RFC 4253, and moves to Historic RFC 4345.
> """
>
> 1. Introduction
>
>
> """
> RC4 is broken""
> """
>
> Although English is not my main language, it sounds a bit abrupt to me and
> it might be preferred to sue something around the lines of
> draft-ietf-curdle-des-des-des-die-die-die-05:
>
> RC4 encryption is steadily weakening in cryptographic strength, and the
> deprecation process should be begun for their use in SSH.
>
>
> It seems to me that sections 1, 2 3 could be merged. I would propose the
> following text. I am providing comments in <mglt></mglt>.
>
>
>
> 1. Introduction
>
>
> The usage of RC4 suites ( also designated as arcfour ) for SSH are
> specified in RFC 4253 and RFC 4345. RFC 4253 specifies the allocation of
> the "arcfour" cipher for SSH. RFC 4345 specifies and allocates the the
> "arcfour-128" and "arcfour-256" ciphers for SSH.
>
> RC4 encryption is steadily weakening in cryptographic strength
> [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and the
> deprecation process should be begun for their use in Secure Shell (SSH)
> [RFC4253]. Accordingly, RFC 4253 is updated to note the deprecation of the
> RC4 ciphers and RFC 4345 is moved to Historic as all ciphers it specifies
> MUST NOT be used.
>
> <mglt>I believe that this document is very closed to
> [draft-ietf-curdle-des-des-des-die-die-die-05] and as such a reference to
> it should be mentioned. </mglt>
>
>
> 2.  Requirements Notation
>
>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
> "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
> document are to be interpreted as described in BCP 14 [RFC2119, RFC8174]
> when, and only when, they appear in all capitals, as shown here.
>
> 3. Updates to RFC 4253
>
> RFC 4253 is updated to prohibit arcfour's use in SSH.
>
> <mglt>
> """
> The last sentence of the paragraph on RC4 (called "arcfour"
>    in [RFC4253]) in Section 6.3 of [RFC4253]
> """
>
> I believe that it might be clearer to quote the text as it is not easy to
> locate it. I would propose the text below. </mglt>
>
> RFC 4253 allocate the "arcfour" cipher in Section 6.3 by defining a list
> of defined ciphers where the "arcfour" cipher appears as optional as
> mentioned below:
>
> """
>       arcfour          OPTIONAL          the ARCFOUR stream cipher
>                                          with a 128-bit key
> """
>
> The current document updates the status of the "arcfour" ciphers in the
> list of RFC 4253 Section 6.3 by moving it from OPTIONAL to MUST NOT.
>
> """
>       arcfour          MUST NOT          the ARCFOUR stream cipher
>                                          with a 128-bit key
> """
>
> RFC 4253 defines the "arcfour" ciphers with the text mentioned below:
> """
>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
>    The Arcfour cipher is believed to be compatible with the RC4 cipher
>    [SCHNEIER].  Arcfour (and RC4) has problems with weak keys, and
>    should be used with caution.
> """
>
> The current document updates RFC 4253 Section 6.3 by replacing th etext
> above with the following text:
>
> """
>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
>    The Arcfour cipher is believed to be compatible with the RC4 cipher
>    [SCHNEIER].  Arcfour (and RC4) is steadily weakening in cryptographic
> strength [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and
>    MUST NOT be used.
> """
>
> 4. IANA Considerations
>
> <mglt>There is a reference to 3DES i think should be removed. In addition,
> IANA cannot be required to update RFCs. IANA is assigned to update the SSH
> registries. With [IANA] being an informational reference to
> https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml,  I
> would propose the following text :</mglt>
>
> The IANA is requested to update the Encryption Algorithm Name  Registry of
> the Secure Shell (SSH) Protocol Parameters [IANA]. The Registration
> procedure is IETF Review which is achieved by this document. The registry
> should be updated as follows:
>
> Encryption Algorithm Name     Reference     Note
> arcfour                          [RFC-TBD]
> arcfour128                     [RFC-TBD]
> arcfour256                     [RFC-TBD]
>
>
> Where TBD is the RFC number assigned to the document.
>
>
>
>